I can't get this to work with an App Web. Says permission denied with Admin creds
– ColbsJul 6 '16 at 17:24

1

Keep in mind that calls to the SP API need to run under the security context of the user. You should login to SP. Open another tab (same browser) and enter the url with the apo call to test the access. The tabs should maintain the same security context. Double check that an Authorization header is send to the server with an auth token (dev tools)
– ozkaryJul 7 '16 at 1:54